338 Commits

Author SHA1 Message Date
Marcos Pividori
1d98b650ef [libFuzzer] Fix test because cmd prompt does not expand wildcard.
Commands should expand the wildcards on Windows, the cmd prompt doesn't.
Because of that sancov was not finding the needed file.
To deal with this, we use ls and xargs from gnu win utils.

Differential Revision: https://reviews.llvm.org/D29374

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@293825 91177308-0d34-0410-b5e6-96231b3b80d8
2017-02-01 22:39:55 +00:00
Kostya Serebryany
63c362484c [libFuzzer] increase the default size for shmem
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@293722 91177308-0d34-0410-b5e6-96231b3b80d8
2017-02-01 00:07:47 +00:00
Kostya Serebryany
001f56735f [libFuzzer] make shmem more robust in the presence of signals
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@293339 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-27 22:41:30 +00:00
Kostya Serebryany
fc4ec25a17 [libFuzzer] make sure we use the feedback from std::string operator ==
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292835 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-23 22:11:04 +00:00
Kostya Serebryany
f7ac01d0a0 [libFuzzer] deflake a test
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292813 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-23 18:44:40 +00:00
Marcos Pividori
6ea436d7ac [libFuzzer] Add missing dependency for tests.
Dependency on TestBinaries was erroneously removed on r292735.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292765 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-22 21:55:46 +00:00
Marcos Pividori
7728ff0f87 [libFuzzer] Specify the CRT considered (MT or MD) for tests on Windows.
Differential Revision: https://reviews.llvm.org/D28439

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292749 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-22 02:28:12 +00:00
Marcos Pividori
2858ad7ec2 [libFuzzer] Fix test with shared libraries on Windows.
We need to set BINARY_DIR to: ${CMAKE_BINARY_DIR}/lib/Fuzzer/test , so the dll
is placed in the same directory than the test LLVMFuzzer-DSOTest, and is found
when executing that test.
As we are using CMAKE_CXX_CREATE_SHARED_LIBRARY to link the dll, we can't modify
the output directory for the import library. It will be created in the same
directory than the dll (in BINARY_DIR), no matter which value we set to
LIBRARY_DIR. So, if we set LIBRARY_DIR to a different directory than BINARY_DIR,
when linking LLVMFuzzer-DSOTest, cmake will look for the import library
LLVMFuzzer-DSO1.lib in LIBRARY_DIR, and won't find it, since it was created in
BINARY_DIR. So, for Windows, we need that LIBRARY_DIR and BINARY_DIR are the
same directory.

Differential Revision: https://reviews.llvm.org/D27870

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292748 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-22 02:28:08 +00:00
Marcos Pividori
9c2ee32cbf [libFuzzer] Leak Sanitizer is not supported for Windows.
Differential Revision: https://reviews.llvm.org/D28709

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292745 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-22 01:58:55 +00:00
Marcos Pividori
44ad5c2d2c [libFuzzer] Fix OutOfMemory tests to work on 32 bits.
I add 2 changes to make the tests work on 32 bits and on 64 bits.
I change the size allocated to 0x20000000 and add the flag: -rss_limit_mb=300.
Otherwise the output for 32 bits and 64 bits is different.
For 64 bits the value 0xff000000 doesn't exceed kMaxAllowedMallocSize.
For 32 bits, kMaxAllowedMallocSize is set to 0xc0000000, so the call to
Allocate() will fail earlier printing "WARNING: AddressSanitizer failed to
allocate ..." , and wont't call malloc hooks.
So, we need to consider a size smaller than 2GB (so malloc doesn't fail on
32bits) and greater that the value provided by -rss_limit_mb.
Because of that I use: 0x20000000.

Differential Revision: https://reviews.llvm.org/D28706

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292744 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-22 01:58:50 +00:00
Marcos Pividori
3bd9b31212 [libFuzzer] Remove lib prefix from library names on tests.
This changes is necessary on Windows, where libraries doesn't include the prefix
"lib".

Differential Revision: https://reviews.llvm.org/D28710

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292742 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-22 01:58:40 +00:00
Marcos Pividori
8f08df7ee1 [libFuzzer] Consider both possible separators for tests.
Differential Revision: https://reviews.llvm.org/D28636

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292740 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-22 01:58:31 +00:00
Marcos Pividori
d2146889b5 [libFuzzer] Remove optimization flags for tests.
We need to build all the tests with -O0, otherwise optimizations may merge some
basic blocks and the tests will fail.
In this diff, I simplify the cmake implementation and I remove the flags for
Windows too (/O[123s]).

Differential Revision: https://reviews.llvm.org/D28632

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292737 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-22 01:27:42 +00:00
Marcos Pividori
4509e88ac3 [libFuzzer] Remove dependencies for tests on Windows.
Remove dependency on FileCheck, sancov and not for tests on Windows.
If LLVM_USE_SANITIZER=Address and LLVM_USE_SANITIZE_COVERAGE=YES, this will
trigger the building of dependencies with sanitizer instrumentation.
This will fail in Windows, since cmake will use link.exe for linking and won't
include compiler-rt libraries.

Differential Revision: https://reviews.llvm.org/D27993

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292735 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-22 01:27:34 +00:00
Marcos Pividori
bcc6b36ead [libFuzzer] Disable afl tests for Windows.
On Windows, we don't have interoperability between libFuzzer and afl.

Differential Revision: https://reviews.llvm.org/D28355

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292734 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-22 01:26:18 +00:00
Kostya Serebryany
e0c77c88b7 [libFuzzer] use print+exit(1) instead of assert to report an error
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292685 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-21 00:13:50 +00:00
Kostya Serebryany
79f0d94edf [libFuzzer] re-enable LLVMFuzzer-RepeatedMemcmp test, cleanup the test runner nearby
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292683 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-21 00:01:27 +00:00
Marcos Pividori
cad86c75f7 [libFuzzer] Use clang as linker on Windows, to properly include sanitizer libraries.
In order to use sanitizers on Windows, we need to link against many runtime
libraries which will depend on the target being created (executable or dll) and
the c runtime library used (MT/MD).
By default, cmake uses link.exe for linking, which fails because we don't
specify the appropiate dependencies. As we don't want to consider all of that
possible situations which depends on the implementation of the compiler-rt, the
simplest option is to change the rules for linking executables and shared
libraries, using the compiler instead of link.exe.
Clang driver will consider the sanitizer flags, and automatically provide the
required libraries to the linker.

Differential Revision: https://reviews.llvm.org/D27869

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292669 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-20 22:49:08 +00:00
Marcos Pividori
40dcc15c25 [libFuzzer] Properly use compiler options supported on Windows.
Replace "-g" by "-gline-tables-only". "-g" is not supported by clang-cl.

Differential Revision: https://reviews.llvm.org/D27868

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292668 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-20 22:48:47 +00:00
Kostya Serebryany
c29243753f [libFuzzer] add an assert to protect against LLVMFuzzerInitialize changing argv[0]
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292652 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-20 21:34:24 +00:00
Kostya Serebryany
74041145bc [libFuzzer] experimental support for 'equivalance fuzzing'
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292646 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-20 20:57:07 +00:00
Kostya Serebryany
6610ca1b8f [libFuzzer] improve -minimize_crash: honor -artifact_prefix= and don't special case 2-byte inputs
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292511 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-19 19:38:12 +00:00
Kostya Serebryany
e1feb39408 [libFuzzer] add two tests for experimenting with equivalence fuzzing
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292509 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-19 19:07:26 +00:00
Kostya Serebryany
4fc16710d9 [libFuzzer] exit(1) on failed merge
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292319 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-18 00:55:29 +00:00
Mike Aizatsky
56992074d3 [libfuzzer] fixing collected pc addresses for coverage
Summary: The causes google/ossfuzz#84

Reviewers: kcc

Subscribers: mgorny

Differential Revision: https://reviews.llvm.org/D28827

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292289 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-17 23:11:32 +00:00
Kostya Serebryany
db5325aae3 [libFuzzer] use table of recent compares for memcmp/strcmp (to unify the code between cmp and memcmp handling)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292287 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-17 23:09:05 +00:00
Kostya Serebryany
93bacfd838 [libFuzzer] improve error handling during the merge (handle various IO failures)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@291182 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-05 22:05:47 +00:00
Kostya Serebryany
e929bfc24b [libFuzzer] make __sanitizer_cov_trace_switch more predictable
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@290703 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-29 02:50:35 +00:00
Mike Aizatsky
d576930959 [libfuzzer] dump_coverage command line flag
Reviewers: kcc, vitalybuka

Differential Revision: https://reviews.llvm.org/D27942

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@290138 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-19 22:18:08 +00:00
Kostya Serebryany
cc82ac2f3b [libFuzzer] use less memory for merge
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@290039 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-17 08:20:24 +00:00
Kostya Serebryany
99cbf23989 [libFuzzer] remove stale test
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@290033 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-17 02:18:59 +00:00
Kostya Serebryany
fdff3a8925 [libFuzzer] when tracing switch statements, handle only one case at a time (to make things faster). Also ensure that the signals from value profile do not intersect with the regular coverage
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@290031 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-17 02:03:34 +00:00
Mike Aizatsky
48d47ae3d9 [libfuzzer] removing experimental FuzzerFnAdapter
Summary: This is superceded by protobuf mutation work.

Reviewers: kcc

Subscribers: mgorny

Differential Revision: https://reviews.llvm.org/D27865

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@290018 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-17 00:12:13 +00:00
Marcos Pividori
37ea43a17c [libFuzzer] Remove unnecessary includes of posix headers.
Remove includes of "unistd.h" header, which is missing in non posix
systems.

Differential Revision: https://reviews.llvm.org/D277300

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289965 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-16 17:35:21 +00:00
Marcos Pividori
1c5866fe6b [libFuzzer] Update tests to use more general functions instead of posix specific.
Replace sleep() posix function by a more portable sleep_for() function
from std. Also, ignore memmem() and strcasestr() on Windows.

Differential Revision: https://reviews.llvm.org/D27729

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289964 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-16 17:35:13 +00:00
Kostya Serebryany
abe2ee53b6 [libFuzzer] enable the failure-resistant merge by default (with trace-pc-guard only)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289772 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-15 06:21:21 +00:00
Marcos Pividori
f2c03c3bb0 [libFuzzer] Fix bug in detecting timeouts when input string is empty.
I added a new flag RunningCB to know if the Fuzzer's main thread is
running the CB function, instead of using (!CurrentUnitSize).
(!CurrentUnitSize) doesn't work properly. For example, in FuzzerLoop.cpp,
inside ShuffleAndMinimize() function, we execute the callback with an
empty string (size=0). Previous implementation failed to detect timeouts
in that execution.
Also, I add a regression test for that case.

Differential Revision: https://reviews.llvm.org/D27433

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289561 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-13 17:46:25 +00:00
Kostya Serebryany
d7b8181022 [libFuzzer] don't require extra flags with -minimize_crash=1 (default to -max_total_time=600). Also respect exact_artifact_path when outputting the end result
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289506 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-13 00:40:47 +00:00
Kostya Serebryany
6e5e12ede9 [libFuzzer] split one slow test into several, for more parallel testing
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289481 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-12 22:55:25 +00:00
Kostya Serebryany
3e014d06f7 [libFuzzer] make SimpleCmpTest a bit simpler to crack and more verbose
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289477 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-12 22:39:33 +00:00
Kostya Serebryany
851cd4f9a2 [libFuzzer] build libFuzzer itself with asan
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289469 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-12 20:58:10 +00:00
Kostya Serebryany
3937d703a6 [libFuzzer] respect -max_len during merge
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289467 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-12 20:39:35 +00:00
Kostya Serebryany
d123ac5f20 [libFuzzer] don't depend on time in a test
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289368 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-11 06:28:09 +00:00
Kostya Serebryany
d27bd04048 [libFuzzer] test cleanup (3)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289314 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-10 02:48:42 +00:00
Kostya Serebryany
5cb386d1cd [libFuzzer] test cleanup (2)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289313 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-10 02:47:00 +00:00
Kostya Serebryany
9c5c57d05a [libFuzzer] test cleanup
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289312 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-10 02:45:56 +00:00
Kostya Serebryany
1b6cd25422 [libFuzzer] switch all libFuzzer tests to use -fsanitize-coverage=trace-pc-guard. Support for the previosly used instrumentation will be removed in the following changes
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289311 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-10 02:26:23 +00:00
Kostya Serebryany
a3def13005 [libFuzzer] implement crash-resistant merge (https://github.com/google/sanitizers/issues/722). This is a first experimental variant that needs some more testing, thus not yet adding a lit test (but there are unit tests).
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289166 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-09 01:17:24 +00:00
Kostya Serebryany
f833935579 [libFuzzer] add a test for r288389 (-rss_limit_mb=0 means no limit).
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@288392 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-01 18:02:07 +00:00
Kostya Serebryany
0719114a69 revert r288283 as it causes debug info (line numbers) to be lost in instrumented code. also revert r288299 which was a workaround for the problem.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@288300 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-01 02:06:56 +00:00